Privacy Policy

Last updated: 31 August 2026

1. Purpose of this Policy

This Privacy Policy explains how VERALYA LTD, trading as ELVYNECO, collects, uses, stores, discloses and protects personal data in connection with:

• operating the elvyneco.com website;

• creating and using customer accounts;

• managing orders and payments;

• shipping and tracking parcels;

• managing returns, refunds and complaints;

• preventing fraud;

• communicating with customers;

• analysing and improving the Site; and

• carrying out our marketing activities where consent or another valid legal basis allows us to do so.

This Policy applies to visitors, customers and anyone who communicates with ELVYNECO.

2. Data Controller

The primary data controller is:

VERALYA LTD — ELVYNECO
Private company limited by shares
Registered in England and Wales
Company number: 16839333

Address:

Suite A, 82 James Carter Road
Mildenhall
United Kingdom
IP28 7DE

Privacy email: support@elvyneco.com
Telephone: +44 7848 109569

VERALYA LTD determines the essential purposes and means of processing its customers’ data, except where a service provider acts as an independent data controller for its own services.

3. Legal Framework

Depending on the location of the data subject and the nature of the processing, we apply, in particular:

• the UK General Data Protection Regulation (UK GDPR);

• the Data Protection Act 2018;

• the European Union General Data Protection Regulation (EU) 2016/679, where applicable;

• applicable rules governing electronic communications, cookies and direct marketing; and

• other mandatory local laws applicable in the markets where we offer our products.

4. Data You Provide to Us

We may collect the following data when you provide it directly to us.

4.1 Identity and Contact Details

• first and last name;

• email address;

• telephone number;

• billing address;

• delivery address; and

• country, region and postcode.

4.2 Order Information

• products and variants ordered;

• quantities;

• order value;

• currency;

• discounts applied;

• taxes and delivery charges;

• order history;

• payment and delivery status; and

• cancellation, return or refund requests.

4.3 Customer Account

• email address associated with the account;

• profile information;

• saved addresses;

• order history;

• account preferences; and

• data required for authentication.

Depending on Shopify’s configuration, you may sign in using a code or temporary link sent by email. VERALYA LTD does not necessarily receive the authentication secret used by Shopify.

4.4 Customer Support

• content of emails and messages;

• order number;

• reason for the enquiry;

• photographs or videos provided;

• information concerning a parcel, product or return; and

• complaint history.

4.5 Reviews and Content

Where this feature is available:

• ratings and reviews;

• comments;

• photographs or videos;

• survey responses; and

• information relating to your experience with a product.

Please do not publish unnecessary personal data in a public review.

5. Payment Data

Payments are processed by the providers offered at checkout, including Shopify Payments, PayPal or any other provider enabled on the store.

VERALYA LTD does not directly receive or store your full payment card number or security code.

We may nevertheless receive:

• the cardholder’s name;

• the billing address;

• the amount and currency;

• the payment status;

• a transaction identifier or token;

• the type of payment method;

• risk or authentication indicators; and

• results required for fraud prevention.

Payment providers may process certain data as independent data controllers in accordance with their own privacy policies.

6. Data Collected Automatically

When you use the Site, we or our technical service providers may collect:

• your IP address;

• a device or browser identifier;

• device type;

• operating system;

• browser type and version;

• language and time zone;

• an approximate location inferred from your IP address;

• pages viewed;

• dates and times of visits;

• interactions with features;

• referral source;

• technical errors;

• security logs; and

• cookie identifiers and similar technologies.

The accuracy and nature of this information depend on your device and browser settings, Shopify’s configuration and the consent you provide for cookies.

7. Data Obtained from Third Parties

We may receive data from:

• Shopify and its affiliates;

• payment providers;

• PayPal;

• fraud-prevention services;

• our suppliers and logistics partners;

• carriers;

• parcel-tracking services;

• email and customer-support providers;

• advertising or analytics platforms, only where they have been enabled and are used lawfully; and

• legally authorised public authorities or bodies.

When you directly use Shop, Shop Pay or another consumer service provided by Shopify, Shopify may act as an independent data controller under its own terms and privacy policy.

8. Sensitive Data

We do not seek to systematically collect health data or other special categories of personal data.

When asking a question about a beauty or wellness product, you may voluntarily provide information concerning, for example, an allergy or reaction.

Please provide only the information that is strictly necessary.

If we receive sensitive data, we will limit its use to handling your enquiry and will apply any additional safeguards and legal bases required by applicable law.

Information provided to customer support is not a substitute for advice from a healthcare professional.

9. Purposes and Legal Bases

We use personal data for the following purposes.

9.1 Processing Orders

Purposes:

• recording your order;

• processing payment;

• preparing and shipping products;

• providing confirmations and delivery information; and

• managing cancellations, returns and refunds.

Legal basis: performance of a contract or taking steps at your request before entering into a contract.

9.2 Customer Accounts

Purposes:

• creating and administering the account;

• authenticating the user;

• displaying orders and addresses; and

• providing requested features.

Legal basis: performance of a contract and legitimate interests in providing a secure customer area.

9.3 Customer Support

Purposes:

• answering questions;

• handling complaints;

• resolving delivery or product issues; and

• keeping a record of communications.

Legal basis: performance of a contract, compliance with a legal obligation and our legitimate interest in providing customer support and defending our rights.

9.4 Fraud Prevention and Security

Purposes:

• verifying payments;

• detecting suspicious orders;

• protecting accounts;

• preventing abuse; and

• ensuring the security of the Site.

Legal basis: our legitimate interest in preventing fraud and ensuring security, as well as compliance with certain legal obligations.

9.5 Legal Obligations

Purposes:

• accounting and taxation;

• consumer-related obligations;

• product safety and recalls;

• responding to public authorities; and

• managing disputes.

Legal basis: compliance with a legal obligation.

9.6 Improving the Site

Purposes:

• diagnosing errors;

• measuring performance;

• understanding how features are used; and

• improving the experience and product catalogue.

Legal basis: legitimate interests for strictly necessary processing, and consent where non-essential cookies or tracking technologies are used.

9.7 Direct Marketing

Purposes:

• sending news, offers or recommendations;

• measuring campaign performance; and

• managing preferences and unsubscribe requests.

Legal basis: consent where required, or legitimate interests where the law permits us to contact existing customers about similar products.

You may object to direct marketing at any time.

9.8 Personalised Advertising

If we enable advertising tools in the future, certain device and interaction data may be used to measure or personalise advertisements.

Legal basis: prior consent where required.

These tools must not be activated before consent has been obtained in regions where the law requires it.

10. Legitimate Interests

When we rely on our legitimate interests, we assess:

• whether the processing is necessary;

• the expected benefits;

• its potential impact on individuals;

• safeguards that can reduce that impact; and

• users’ reasonable expectations.

You may object to processing based on legitimate interests. We will stop the processing unless we demonstrate compelling legitimate grounds or the processing is necessary for the establishment, exercise or defence of legal claims.

The right to object to direct marketing is absolute.

11. Transactional and Marketing Communications

Order confirmations, invoices, security information, delivery notifications and customer-support responses are communications required for the contract or requested service.

They cannot always be disabled while they remain necessary for an order or active account.

Marketing communications are separate. You can unsubscribe:

• by using the link included in the email;

• through any available preference settings; or

• by writing to us at support@elvyneco.com.

Unsubscribing from marketing does not prevent us from sending necessary transactional communications.

12. Cookies and Similar Technologies

We may use the following categories.

12.1 Essential Cookies

These are necessary, in particular, for:

• operating the shopping basket;

• checkout;

• authentication;

• security;

• remembering essential choices; and

• load balancing and fraud prevention.

Where permitted by law, these cookies do not require consent.

12.2 Preference Cookies

These may remember:

• language;

• region;

• currency; and

• certain display choices.

12.3 Analytics Cookies

These help us understand how the Site is used and measure its performance.

12.4 Advertising Cookies

Where enabled, these may be used to measure campaigns, limit how often advertisements are displayed or personalise advertising.

Non-essential analytics or advertising cookies are placed only after consent has been obtained where required by law.

You can accept, reject or change your preferences using the cookie banner or cookie-management link available on the Site.

Rejecting cookies must be as easy as accepting them.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

Additional information, including the list and duration of active cookies, is available in our Cookie Policy or preference panel.

13. Recipients of Personal Data

We may disclose data, to the extent necessary, to the following categories of recipients:

• Shopify International Limited and other Shopify group companies;

• Shopify’s technical processors;

• payment providers displayed at checkout;

• PayPal when that payment method is used;

• our suppliers and order-fulfilment partners;

• carriers and tracking services;

• our business email provider;

• customer-support services;

• fraud-prevention providers;

• accounting, legal or tax advisers;

• analytics and advertising tools that are actually enabled, subject to any required consent; and

• legally authorised authorities, courts or bodies.

We limit the data disclosed to what is reasonably necessary for the relevant purpose.

Some recipients act as processors under our instructions. Others, including certain payment providers or carriers, may act as independent data controllers.

14. Shopify

For merchants in the EMEA region, customer data is initially processed by:

Shopify International Limited
The Sidings, 4th Floor
Grand Canal Quay
Dublin D02 E7K8
Ireland

Shopify may use affiliates and processors located in different countries to provide the platform’s infrastructure, payment, security, messaging and other features.

When Shopify processes customer data on behalf of VERALYA LTD, Shopify generally acts as a processor.

When you use a Shopify consumer service such as Shop or Shop Pay, Shopify may act as an independent data controller.

15. Suppliers and Logistics Partners

Depending on the product, certain data required to fulfil the order may be disclosed to a supplier, manufacturer, warehouse or logistics partner.

This data may include:

• the recipient’s name;

• the delivery address;

• a telephone number required for delivery;

• the email address where necessary;

• the products and quantities ordered; and

• delivery instructions.

These partners must use the data only to prepare, ship or track the order, or resolve an issue concerning it, unless otherwise required by law.

16. Sale and Sharing of Data for Advertising

VERALYA LTD does not sell personal data for money.

However, certain laws, particularly in some US states, may regard the disclosure of data for targeted advertising as a “sale”, “sharing” or similar activity.

Where those laws apply and such tools are enabled, you may exercise your right to opt out by using:

• the privacy preference panel;

• the “Your Privacy Choices” link, where displayed on the Site; or

• a request sent to support@elvyneco.com.

17. Automated Decision-Making and Fraud Prevention

Shopify, PayPal, our payment providers or our fraud-prevention tools may use automated processing to generate:

• a risk score;

• a recommendation to accept or decline a transaction;

• an authentication request; or

• a warning concerning an unusual transaction.

These indicators may lead to a review, delay, payment refusal or cancellation where legally justified.

Where applicable law gives you the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, you may request human intervention and challenge the decision by writing to support@elvyneco.com.

Some providers make their own decisions as independent data controllers. Their own policies and appeal procedures may therefore apply.

18. International Transfers

Our service providers and partners may process data outside the United Kingdom or European Economic Area.

These countries may include Canada, the United States, Singapore or countries where certain suppliers, warehouses or carriers are located.

Where the law requires a specific safeguard, we or our service providers may rely on:

• an adequacy decision;

• the European Commission’s Standard Contractual Clauses;

• the UK International Data Transfer Agreement;

• the UK Addendum to the EU Standard Contractual Clauses;

• approved binding corporate rules; or

• another safeguard authorised under applicable law.

Transfer risk assessments and supplementary measures are implemented where required.

You may request further information about the applicable safeguards by writing to support@elvyneco.com. Certain confidential or protected information may be redacted.

19. Retention Periods

We retain data only for as long as necessary for the purposes stated, after which we delete or anonymise it, or restrict access to it.

Indicative retention periods are as follows:

• orders, invoices and accounting documents: generally between 6 and 10 years, depending on tax and accounting requirements and the country concerned;

• account data: for as long as the account is used, and then for the period required to manage its closure, orders and legal obligations;

• customer-support requests: generally for up to 3 years after resolution, unless longer retention is required for a warranty, dispute or legal obligation;

• marketing data: until consent is withdrawn, an objection is made or the applicable inactivity period expires in accordance with local law;

• records of consent or objection: for as long as necessary to demonstrate compliance with our obligations;

• security and fraud data: for as long as necessary to investigate the matter, prevent further incidents and defend legal rights; and

• cookies: for the periods stated in the preference panel or Cookie Policy.

Backups may retain certain data for a limited additional period before being automatically overwritten.

These periods may be extended where legal proceedings, an investigation, a preservation obligation or a product recall requires it.

20. Security

We implement technical and organisational measures proportionate to the risks, which may include:

• TLS encryption for communications;

• enhanced authentication for administrative access where available;

• access controls and restrictions;

• permission management;

• security-event logging;

• selecting service providers with appropriate safeguards;

• incident-management procedures; and

• limiting the data collected.

No system can guarantee absolute security.

In the event of a personal data breach, we will take the measures required by law, including notifying the relevant supervisory authority and affected individuals where required.

21. Your Rights

Depending on applicable law and the legal basis for processing, you may have the following rights:

• the right to be informed;

• the right of access;

• the right to rectification;

• the right to erasure;

• the right to restriction of processing;

• the right to data portability;

• the right to object;

• the right to withdraw consent;

• the right not to be subject to certain decisions based solely on automated processing; and

• the right to lodge a complaint with a supervisory authority.

These rights are not absolute. Certain data may be retained where a legal obligation or legitimate reason justifies doing so.

22. Exercising Your Rights

To exercise a right, please write to:

support@elvyneco.com

Clearly describe your request and provide the information needed to identify you.

We may ask for reasonable proof of your identity to prevent an unauthorised person from accessing your data.

We normally respond within one month. This period may be extended where the request is complex or several requests have been received, in accordance with applicable law. If so, we will inform you of the extension and the reasons for it.

Requests are normally free of charge. We may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive, to the extent permitted by law.

23. Complaints to a Supervisory Authority

We encourage you to contact us first so that we can try to resolve your concern.

You may also lodge a complaint with the relevant supervisory authority.

United Kingdom

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Website: https://ico.org.uk/make-a-complaint/

European Union

You may contact the data protection authority in the country where you live or work, or where you believe an infringement has taken place.

For France:

Commission nationale de l’informatique et des libertés (CNIL)
Website: https://www.cnil.fr/

24. Children’s Privacy

The Site and customer accounts are not intended for anyone under the age of 16.

Orders must be placed by someone who is at least 18 years old or who has the necessary authorisation and legal capacity.

Although certain products may be intended for children, they must be purchased by an adult.

We do not knowingly collect personal data directly from a child without valid authorisation. If you believe a minor has provided data to us inappropriately, please contact us at support@elvyneco.com.

25. Third-Party Links and Services

The Site may contain links to or integrations with third-party services.

When you leave elvyneco.com or directly use a third-party service, that provider’s own privacy policy may apply.

We encourage you to review the policies of the relevant providers, including payment and delivery services, Shop, Shop Pay and social networks.

26. Changes to this Policy

We may update this Privacy Policy to reflect:

• changes to our processing activities;

• the addition or removal of a service provider;

• regulatory changes;

• changes to the Site; or

• improvements in transparency.

The updated date will appear at the top of the page.

Where a change is material, we will provide additional notice by email, on the Site or through the customer account where required or appropriate.

27. Contact

For any privacy-related question or request:

VERALYA LTD — ELVYNECO
Company number: 16839333
Email: support@elvyneco.com
Telephone: +44 7848 109569

Busness address: Suite A, 82 James Carter Road
Mildenhall
United Kingdom
IP28 7DE